Privacy policy
Last updated: 23 October 2026, version 2026-10-23. Section 12 (this website) is specific to pergamed.com.
This policy explains how the Sutura - Plastic Surgery mobile app ("Sutura") processes your personal data. It also serves as the information notice under Article 13 of the EU General Data Protection Regulation (GDPR), the UK GDPR and Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).
Controller: Pergamed (placeholder — the full name and address of the controller will be added once the publisher is finalised). Contact: support@pergamed.com.
In short
- Sutura shows no ads and uses no analytics, tracking or crash-reporting tools.
- Your logbook, shifts and quiz progress are stored only on your device. If you create an account, your profile details (name, hospital, department, title, residency start) are also saved to your account so they come back when you log in.
- If you create an account, the server stores your email address, account ID, country, email-consent choice and profile details; if you join the weekly league, also your nickname and points (only the nickname is shown in the standings).
- Promotional and news emails are sent only if you explicitly opt in; the box is unticked by default and you can withdraw consent at any time.
- Payments are handled by Apple or Google; Sutura never sees your card details.
1. Information stored on your device
- Profile: first and last name, hospital, department, title and residency start date — used only to address you on screen, show your name on the logbook export and show the length of your residency. If you have an account it is also saved to your account (section 2).
- Logbook: date of operation, procedure, your role and an optional note. Do not enter patient names, record numbers or anything that could identify a patient.
- On-call shifts: date, type, end time and an optional note.
- Preferences and progress: language, quiz answers and progress, followed journals, whether the intro tour has been shown.
This information stays in the app's local storage and is removed from the device when you uninstall the app or log out. Apart from the profile, it is never sent to a server.
2. Account data processed on the server
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address, password (stored only as a hash), account ID, email-verification status | Creating the account, sign-in, email verification, password reset | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) | While your account exists; deleted when you delete the account |
| Country and the resulting email language (Turkish for Türkiye, English elsewhere) | Applying the correct legal rules and choosing the email language | Legal obligation and legitimate interest (GDPR Art. 6(1)(c), (f)) | While your account exists |
| Marketing-email consent: given/not given, date and time, consent-text version, country, where it was collected (the app) | Proving your consent; not emailing you without it | Consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)); keeping the record: legal obligation (GDPR Art. 7(1); Turkish e-commerce law) | While your account exists; a withdrawal is also recorded with its date. If you delete your account, only your email address and consent history are kept in a separate record for 3 years to meet the statutory evidence requirement, then deleted automatically |
| Profile: first and last name, hospital, department, title, residency start date | Restoring your profile when you log in on another device or after logging out | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) | While your account exists; deleted when you delete the account |
| Purchase data: account ID, Pro/Platinum status, product type, store transaction ID | Unlocking Pro/Platinum and restoring purchases | Performance of a contract (GDPR Art. 6(1)(b)) | For the subscription and statutory retention periods |
| Weekly league (only if you join): the nickname you choose, your league (Bronze/Silver/Gold), your weekly points and the question number and time of each scoring answer | Building the weekly standings and verifying points on the server | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) — a feature you request | Nickname and league while your account exists; weekly point records at most 1 year. Other users see only your nickname and points; your name and email are never shown |
Your logbook, shifts and quiz data are not sent to the server even when you have an account.
3. Types of email
- Service emails: messages needed for the account to work, such as the verification link and password reset. No separate consent is required.
- Promotional, announcement and news emails: sent only if you tick the separate box at sign-up or on the Account screen. You can withdraw consent with one tap on the Account screen or via the unsubscribe link in every email. Emails to users in Türkiye are sent in Turkish; users elsewhere receive them in English.
4. Service providers (processors)
- Google Firebase (Google Ireland Ltd. / Google LLC): storing account and consent records. The database is hosted in the European Union; the authentication service may use Google's global infrastructure.
- Cloudflare, Inc. (USA; Cloudflare Email Sending): sending account emails (verification and password reset) from
noreply@pergamed.com. Cloudflare receives only the recipient's email address and the email content (the action link). These emails are prepared on Google Firebase (Cloud Functions, EU region). - RevenueCat, Inc. (USA): validating in-app purchases and keeping your Pro status. RevenueCat receives only your account ID and the store's purchase data, not your email address.
- Apple and Google: payments and subscriptions are processed by them under their own policies.
- Bulk email provider: if one is used in future for marketing emails, it will receive only the email address, language and country of users who opted in. This section will be updated when a provider is chosen.
International transfers: some providers are outside your country (EU and USA). Transfers from the EU/UK rely on the Standard Contractual Clauses (GDPR Art. 46) or the EU–US Data Privacy Framework; transfers from Türkiye follow KVKK Art. 9.
5. Your rights
Under the GDPR, UK GDPR, KVKK and similar laws you have the right to access, rectify and erase your data, to restrict or object to processing, to data portability and to withdraw consent at any time (without affecting earlier lawful processing). Residents of other countries (for example under US state privacy laws, Canada's CASL/PIPEDA or Switzerland's FADP) have the corresponding rights under their local law.
- Download my data: export the data held on your device and on the server as a single JSON file from the Account screen.
- Delete account: delete your account from the Account screen; your server account record and preferences are erased. If you ever had a consent record, a proof record containing only your email address and consent history is kept for 3 years (Turkish commercial electronic communications rules; GDPR Art. 7(1) and 17(3)(b)) and then deleted automatically; it is used for no other purpose.
- For any other request write to support@pergamed.com; we reply within 30 days.
- You may lodge a complaint with your local data protection authority (in Türkiye: the Personal Data Protection Authority, KVKK).
6. Permissions
- Calendar: requested only when you add a shift to your phone's calendar. Sutura writes only the shift events you add and removes the event of a shift you delete; it does not read your other events.
7. Other features that use the internet
- Congresses: dates are downloaded from a public data file (GitHub Pages); no personal data is sent.
- Journals: titles, authors and dates of articles in the latest issue of journals you follow are retrieved from PubMed (
eutils.ncbi.nlm.nih.gov) and Crossref (api.crossref.org). Requests contain only the journal's ISSN and, as these services ask, the app's support email address.
These services can technically see your device's IP address; Sutura sends them nothing about you.
8. Logbook export
When you export your logbook as an Excel file, the file is created on your device and your phone's share sheet opens; you decide whom to share it with.
9. Children
Sutura is intended for physicians and adults in medical training; it is not directed at anyone under 18.
10. Medical disclaimer
Sutura is an educational tool. Its content and calculators (such as the botulinum toxin reconstitution calculator) must not be used on their own for medical decisions, diagnosis or treatment; dosing decisions remain with the physician.
11. Changes
If this policy changes, the current version will be published on this page and the date and version at the top will be updated. If the marketing-consent wording changes, your consent will be asked for again.
12. This website
pergamed.com sets no cookies, contains no analytics or tracking tools and loads no fonts or scripts from other sites. It is hosted on GitHub Pages (GitHub, Inc., USA); GitHub may briefly keep visitors' IP addresses in technical logs to serve and secure the site. If you email us, your address and message are used only to answer your request.
The account page at pergamed.com/hesap/, which opens from Sutura's verification and password-reset emails, sends the one-time code from the link (and, for a password reset, your new password) directly to Google Firebase Authentication to complete the request. It sets no cookies and stores nothing in your browser.